MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1beded3e8f84a0b14c83a0da14162c7d8426c9293ae7eaff5db82f5db7ff4c78. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1beded3e8f84a0b14c83a0da14162c7d8426c9293ae7eaff5db82f5db7ff4c78
SHA3-384 hash: 2f7d84a379223eaf5616c1ce4cfbcedc665afdd5fb342e07b3eb06fcf25f676dcc3acd931b57e4a998abac2aed9417ed
SHA1 hash: e49450d64ce7db1443cfe76252a5cdaad5af0ed9
MD5 hash: ca90fcf559dcf86ef2f06add33cbf125
humanhash: enemy-undress-mike-venus
File name:ca90fcf559dcf86ef2f06add33cbf125.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:999'424 bytes
First seen:2022-10-06 11:31:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:dHpqARBBkPVcMYBL+M94cl1/jO4+UOeR2hk18Yl/7R8p8oY7KCm5ssVpCdT6T4ve:j/BkP2RBmSBB+gn18Ylzb7LVvQT4ve
Threatray 20'442 similar samples on MalwareBazaar
TLSH T1B925D03502E6C60BD1065338DDE2D3F0AFE86DA5A671C3474FE9BC6FB5471A6AB40284
TrID 49.6% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
21.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
8.9% (.SCR) Windows screen saver (13101/52/3)
7.1% (.EXE) Win64 Executable (generic) (10523/12/4)
4.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon ec82e8e8eab2ced8 (17 x SnakeKeylogger, 9 x Loki, 9 x AgentTesla)
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
smtp.ionos.es:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
212
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/317272/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.389.22426.10826.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/633ebcb9dace43a378f44341/reports/7c3f3848-d783-4419-ab54-afee55feaa61/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ab8becca-be85-4495-8c0d-cd745066f724
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1084907
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1beded3e8f84a0b14c83a0da14162c7d8426c9293ae7eaff5db82f5db7ff4c78/
Threat name:
ByteCode-MSIL.Trojan.RealProtectPENG
Create hunting rule
Status:
Malicious
First seen:
2022-10-06 07:01:01 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dpw62pupqsqlctedudnbifrmpwccnsjjhlt6v725xaxv3n77jr4a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0fffaa8699a3772768a88fd093cb08eae96c3fd7d694f4c912c9fabb472be073
AgentTesla
42b0ccbc2545a60b0aefdce149c1d3e766293ba645afb3d1ba905be1dc765fe9
AgentTesla
57a45cc2512f42b829e6d52fd76edb3f1e9d6b624b8a11ca767186a82d407bc0
AgentTesla
627a153ec26dadb201350e74c5191c0b59456bc85a278cad27c38a023618547c
AgentTesla
87126e672dcbafa6827503b7c2de467eda7f48367dba3db2fe4209f509c6cf6d
AgentTesla
9d19c6e678c823c2c0e75fb23280ae1308a01f52e36e7e327014502e5f907f1a
AgentTesla
f1a566ebee3c225b2683813ce31c30f6e7648c1dcdd03c991a2d2e99c11bc6d7
AgentTesla
+ 20'432 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/221006-nnad4ahbh5/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c0aaa8e9-a378-444d-bcec-d98bce79f491
Unpacked files
SH256 hash:
7872c4eed6ba094a532fa1c068e0593fdc636b4b7ffce910c111cd31dbfd92a8
MD5 hash:
196132b78e48d325c7bda5373d7935fd
SHA1 hash:
d53fdb2b62c3080c33b9e49c8d3dba5ef5ecdf43
Link:
https://www.unpac.me/results/5285cd16-669a-4493-a1e7-78437c44f72f/
SH256 hash:
5fbdcb76c77563ed3d729fdca3396169c54443253001cf9b1b6b75a0f75cdcb4
MD5 hash:
629c31e71cfa6aab7a62bef45298816c
SHA1 hash:
932da9270d08d3b97ad1fb75e3d3180481f91096
Link:
https://www.unpac.me/results/5285cd16-669a-4493-a1e7-78437c44f72f/
SH256 hash:
e7b36c4f0eb53dd74870cc1a23ecef0d928589c87ed656d616615b1956ac478e
MD5 hash:
83d65a5dfb718d49107ef35564cf75e8
SHA1 hash:
39337be1016d80d8e50514c521797a5d157d96f0
Link:
https://www.unpac.me/results/5285cd16-669a-4493-a1e7-78437c44f72f/
SH256 hash:
0561620122b9bb1d991431a4b9c64e361d7d29a20d264fc03ffd03be59e05366
MD5 hash:
386d59248160226b2518d611ebde2ef8
SHA1 hash:
161f177ea529ecf76bb0fc87f7b56b1e138763f5
Link:
https://www.unpac.me/results/5285cd16-669a-4493-a1e7-78437c44f72f/
SH256 hash:
e20ec8f3c957bcb6a194ef688bae8af2015cfffb20e7baf8b2114d7b70ade4ee
MD5 hash:
35cb29046968faca7f3f3b4463449b6c
SHA1 hash:
088c8c30ec1bece0a4b5bbfe3982b073f8b95598
Link:
https://www.unpac.me/results/5285cd16-669a-4493-a1e7-78437c44f72f/
SH256 hash:
1beded3e8f84a0b14c83a0da14162c7d8426c9293ae7eaff5db82f5db7ff4c78
MD5 hash:
ca90fcf559dcf86ef2f06add33cbf125
SHA1 hash:
e49450d64ce7db1443cfe76252a5cdaad5af0ed9
Link:
https://www.unpac.me/results/5285cd16-669a-4493-a1e7-78437c44f72f/
Malware family:
AgentTesla.v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1beded3e8f84/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1beded3e8f84a0b14c83a0da14162c7d8426c9293ae7eaff5db82f5db7ff4c78

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:adonunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:AD on UNIX
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 1beded3e8f84a0b14c83a0da14162c7d8426c9293ae7eaff5db82f5db7ff4c78

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2350853/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/317272/

Comments